Forums

Calendar

Everything posted by Spamnophobic

/devnull prevents reports going to those who would otherwise get them. That is what I mean by protecting them. In my opinion there is a very valid reason, i.e. my address and credit card details with them have been compromised, for sending these reports to amazon's inbox.
SC's historical analysis is certainly worthy, but there is stuff going on on the battlefront here.
I will certainly not send you any unwanted PMs, though I would have liked to prove to someone that amazon.com accounts have been compromised.
NB Amazon doesn't even have a public e-mail address to which I could report abuse. A rapidly increasing tendency among the Internet behemoths.

Spamcop often sends spam reports to the bitbucket (/devnull). Very often this is justified. For instance when a spam includes a link to the valid URL of a commercial bank or business, trying to make their phish pitch seem genuine. That the well-known URL has been included in the spam is in no way the fault of the bank or business and there is nothing they can do about it.
However, recently some web businesses, such as amazon.com, have been compromised and e-mail addresses exclusively shared with them by their customers, such as me, have suddenly started receiving spam. And very nasty spam at that: links which if clicked will encrypt every file on my system and make me liable for extortionate payments: ransomware.
This was today the case with my amazon.com account. I was therefore very disappointed to see SpamCop protecting amazon.com by not allowing my report of this serious security breach to be sent to postmaster@amazon,com Of course I could send a copy of this report myself, but amazon would simply reject my e-mail as being from an insignificant individual and not even read it, whereas SpamCop reports carry status, which as a faithful SpamCop reporter of many years standing, I feel myself entitled to leverage.
SpamCop should cease to protect postmaster@amazon,com from SpamCop reports, because amazon.com has clearly been hacked and their customer confidentiality breached.
Tracking URL: http://www.spamcop.net/sc?id=z6425955718ze5e589fdfe4e3c3f466cdcb069cf85fcz
I can supply confidential details such as compromised e-mail address to a moderator by PM.

Recently I made an interesting discovery about "my" spam. It has lead me to some new ideas.
My system essentially consists of using disposable addresses (see Sneakemail for the principle). Once too much spam comes in on a given address, it goes into my spam management system. This consists of two phases.
Phase I: intensive reporting
As I award a new address to each person/firm/activity (PFA), I can easily see which of these has been responsible, inadvertently or otherwise, for passing on the address to criminals a.k.a. spammers. From then on I report every such spam via SpamCop, sending copies of the report with appropriate messages to the PFA to whom the address was awarded, alerting them to the breach of confidentiality. This I continue to do for as long as I feel like, but certainly until I am sure that the PFA has got the message. Sometimes it leads to interesting exchanges.
Phase II: the bitbucket
Once I deem the reporting period described in Phase I for a given address to have expired, I set my system to completely /dev/null (delete) any further mail sent to this address unread. Before making this change I usually send the PFA concerned a new e-mail address, on the strict understanding that they will now be more careful with it (which they usually are), or set in place other new measures as appropriate.
This limits the spam received considerably, makes it manageable, but thanks to SpamCop gives me a way of fighting back at the same time. It has served me very well over the years.
Recently I took a new step.
Out of curiosity, about 3 months ago, I removed one of my first, old, bit-bucketing measures. At the centre of this was an address that in its heyday was sending me 10-15 spam per day. To my surprise I have only received 1 spam to this address in 3 months! This has given me food for thought about what may be behind it. Why should a spammer ever drop an address?
Well, first of all of course there is listwashing. However, since the move to Phase II meant that these spam were no longer being reported, there would have been no further incentive from this point on for the spammer to listwash my address. I have now formulated an hypothesis - and it is only that - about how this may come about.
When spamming started, "certain individuals" discovered that using open relays etc., and a bit of SMTP scripting, they could send a mass e-mail to as many addresses as they had, for free. Cue spammers' Eldorado. Response in the arms race was limiting open relays (open proxies, etc. etc.). Spammers' response: enlist hackers to recruit compromised machines to botnets, and continue as before. Response: combat botnets (somewhat succesful, but "snowshoe" techniques etc. still give spammers "bandwidth"). Frankly I've rather lost track of the current state of the art in the arms race, but my general impression is that while we've no way won the war yet, for spammers the law of diminishing returns is perhaps finally setting in.
As spam has become a more and more widely recognised problem, more and more countermeasures have come into place. These days every free mail account even, comes with a spam filter of sorts, for instance. But everywhere more and varied countermeasures can be seen (not least SpamCop!), none of which stop spam, but all of which are gradually pushing up the cost per spam sent. Where once the sky was the limit, now the return in terms of dollar earned or sucker found per unit cost of spam sent is slowly, but inexorably increasing.
We as fighters against spam and criminality have one great advantage over spammers/criminals which we should never forget. We work together, whereas spammers/criminals have to fight against each other. You can see evidence of this for instance where spammers sell each other lists of "100% valid e-mail addresses" but sometimes carefully include known SpamCop reporters in them, so simultaneously sabotaging the efforts of their competitors, a little. It's like the ecosystem of parasites vs. symbionts in the biological world (I once posted on this, hyperlink is http://forum.spamcop.net/topic/9935-resolved%C2%A0multiple-hosts-for-the-same-spamvertised-site/#comment-68121).
At the same time Boris the Botnet Renter isn't getting any cheaper either. So any spammer with even half a thought for their business model, will eventually have to look at their lists, and try to figure out some way of sorting out their highest value addresses from others, with a view to perhaps limiting their spew volume. This is what I believe is happening, slowly.
Well, your mileage may and will of course vary. I freely admit that it's quite a sweeping conclusion to reach on the basis of one spammable e-mail address which seems to have gone out of fashion. It may have been on CDs or DVDs which have since oxidised away, and never made it on to little Alexei's database. But his administrator will be charging him more and more to use the database, or using his bandwidth more productively, fixing elections for instance. Anyway, as I said it's just an hypothesis.
These are just my thoughts, and I don't really have the resources to do more forensic analysis. Like most people, I'm just trying to get by and to manage "my" spam as intelligently as I can.

I only just read this, with great shock.
He was one of the funniest, wisest and kindest people this forum ever had. His insightful and witty contributions were always a joy to read. Sometimes the penny would only drop for me at the third reading and I would burst out laughing. From what Mike says above, and from the person with whom I became acquainted from the several PMs we exchanged, I think the best tribute I can pay is to keep in mind the patience and knowledge he would always offer when posting.
Penny

You could just hit "Replace all". The space was probably the reason the "Find" part of "Find and replace" wasn't working. Replacing 21,630 items took me less than a second. And if it goes wrong just hit undo.

I'm totally puzzled about why Word isn't doing its thing for you. I've run through the procedure now in Word 2007 and in Word 2010. My humble whitelist only ran to 1,5 pages in plain text, but with some exponential cutting and pasting I created lists of 264 pages (Word 2007) and 416 pages (Word 2010).
Both worked as expected, with messages of "Word has completed its search of the document and has made 10,811 replacements" (2007) and "Document search completed. 21,630 items were replaced" (2010, translated from Dutch).
If you're still stuck let me know and I'll PM you an e-mail address to which you can send me some screenprints. I feel it must be something really simple.

Control+h (control key plus lower case aitch) should bring up "Find and replace" in both Notepad and Word (and a lot of other utilities besides) but the Find and replace function in Word has extra options, including many to look for nonprinting characters like hard return (line break). You can find them via the "More" and "Special" options, but the code for hard return is ^p.
I would post a screenprint of the dialogue box, but I can't find any way to upload images to this forum. Perhaps someone else will be along to help with that (blush!)
In the box that says "Replace with" you literally type in ;^p to give the "string" you are going to replace the ^p with. Here I literally mean the ^ character, not "Control" which it is sometimes used as an abbreviation for.
Are you sure you're not hitting ctrl+f (Find)? That brings up a completely new Find function in recent versions of Word, with numbers of hits.

There's an easy way to do it in Word.
After step 5 in:
a. Paste the list in Notepad, it will copy as plain text.
b. Copy the whole list again in Notepad and paste it into a new Word document. It should now appear as plain text in Word.
c. Go to the beginning of the list and press control+h. The "Find and replace" box appears.
d. In the "Find and replace" box, in the "Find" field type ^p (Word calls this "paragraph mark" or somesuch - translating from Dutch Word here - but anyway it really means hard return),
e. In the "Replace with" field type ,^p (comma, hard return).
f. You can test one line with "Find next" if you wish.
g. Press "Replace all".
NB1: If you don't like the result, hit the undo button before you do anything else.
NB2: I have used a literal comma in my instructions above. Unless I am mistaken Excel by default uses a semicolon ( (no I don't mean a winkicon!) in what is unhelpfully called the "comma-separated values" (.csv) format. What the separator actually is on your machine depends on a Windows setting ... but that's another story
NB3: If your list is too long for Notepad, consider using another plain-text editor like Notepad++ or WordPad.
Hope this helps.

I'm thinking that spam messages may get forwarded too. Obviously sending "Vacation responses" to those would be very undesirable.
As far as I have been able to tell, whitelisting will no longer be available once the mailboxes go. However there seems to be some uncertainty about what forwarding will and will not incorporate.
Filtering of spam will take place. Personally I've never found any form of automatic filtering with 100% detection and 0% false positives. The personal control over filtering (such as choose blocklists, blacklisting, greylisting, choose a SpamAssassin threshold, and the Held Mail folder) which we had with SpamCop e-mail will all disappear after September 30th IIUC.
Anyway, there is fairly extensive information on these forums about "Vacation messages", "Out-of-Office", etc., which may help the OP decide how best to arrange things.

Hi Bob,
I think this may have very undesirable consequences for you. Spammers inevitably forge the sender address, often putting in the real address of a completely innocent third party which they have in their lists. That person is going to get a "Vacation response" from you about a mail they did not send, complete with your new e-mail address. You are probably going to get deluged with angry responses from these innocent third parties. They may well even report you for spamming. Reports about automatic responses of this sort to spam are currently accepted by SpamCop IIUC.
Not to mention that all the traffic this will generate is going to increase the chances one way or another of spammers getting hold of your new address.

Thanks Petzl, Mailwasher looks like a good extra option, I'll give it a try.
I've opened a trial account with Runbox. They are mentioned earlier in this thread, but also in a very apposite Bits of Freedom blog page, which however only seems to exist in Dutch.
Dutch, but I suspect if you run it through a translate facility it will be easy to interpret. It reviews good simple e-mail services from a freedom and privacy point of view. It's a bit too long (with all comments and updates) to do a full translation here, but if anyone needs detailed explanation of part of it, please post and I'll do my best to provide custom translations.

Does anyone know of a provider who offers the ability to use blacklists to filter mail, like CESmail did? As long as I'm contributing to the SC blacklist it would be nice to be able to use it as well to filter my incoming mail.

For me it's the SpamCop parse that's the most valuable bit. In the details I can see to which of my Sneakemail-style addresses the spam was sent, and alert the "owner" of that address (by including them in the notifications, with extra text) to the fact that they have allowed, unwittingly or otherwise, my private address to be stolen from them. If the spam volume to that address gets too high, I automatically devnull anything more coming in to that address, after notifying said "owners" of the fact that the address is "closing down".
(Small clarifying change on edit.)

I've seen this mentioned in recent discussions, but the only one I can find using the Search function is http://forum.spamcop.net/forums/index.php?showtopic=13779. This mentions it as a paid account issue, but actually it's a serious issue for anyone with a SpamCop e-mail account reporting spam via the webpage login.
The url https://spamcop.net gives you a certificate error. If you proceed, you are redirected to http://www.spamcop.net, and if you log in there, which you have to do with your full private spamcop e-mail address and password, your mail address and password are sent in clear text.
I only use iexplore.exe. If anyone has different findings with another browser, I'd love to hear.
I have security issues at the moment which I am trying to counter by among other things, not sending anything in clear text. Unsurprisingly, these security issues include parsing spam, targeted phishing attempts in this case. I need not to send stuff in clear text as it may be getting "harvested".
Could SpamCop staff please do something about the fact that https://spamcop.net is not functioning and get it back up and running, for all our sakes and security?
Or is there a new https url for reporting which I've altogether missed?
Thanks.

I've had one recent, but a whole bunch I should have had has not arrived. Russian/Ukranian criminals no doubt, they hate us so much and will do anything to damage us (I keep on reporting, heh heh), but can you give us an update? Should we treat the mails that haven't arrived as lost?

Goodness the levels have fallen since I last looked. Are we winning?
What I still get in terms of "Rianna Lovelya, about your e-mail" type filth suggests that spam is becoming positively old fashioned...?

And great that Linkedin are sending compromised members password-change information by email! Presumably at least the first e-mail will contain a phone number. I wonder how many calls they'll get along the lines of "...ende my motherze mayden nayme was Gherrison...".